Privacy

• We do not run analytics and we do not track you across sites.
• There are no user accounts, so there is no profile of you to build.
• We set two cookies. Both remember a choice you made; neither identifies you.
• If you ask us to email you a trip plan, we send it once and do not keep your address.
• We never sell or rent personal data. There is nothing to sell.

CebuFest is an independent project about travel in Cebu, Philippines. It is not a registered company; it is run by one person. For the purposes of the Philippine Data Privacy Act (RA 10173) and the EU General Data Protection Regulation, that person is the controller of any personal data described here, and can be reached at [email protected].

Cookies. Two, both of which store something you chose: your light or dark colour scheme, and the list of places you added to your trip. Neither contains a name, an email address or an identifier that could be used to recognise you. They are described one by one on the cookies page.

Your email address, only if you ask for a plan by email. On a generated trip plan you can have a copy sent to you. We use the address to send that one message and we do not store it: there is no mailing list, no database record and no marketing to unsubscribe from. Our email provider processes the message on our behalf and keeps its own delivery logs for a period we do not control.

A short-lived abuse counter. To stop the email form being used to send unwanted mail to other people, we hold a count of recent sends against your IP address and against the recipient address. It is kept in the server’s memory only, for one hour at a time, and is never written to disk or joined to anything else.

Your trip plan is in its own web address. When you generate a plan, the places, dates, party size and pace you chose are encoded into the plan’s link rather than saved on our side. That means the plan works without an account and disappears when you stop using the link — but it also means anyone you share the link with can see those details, so treat it the way you would treat any link with your travel dates in it.

Children’s ages, if you enter them. The planner and the hotel pages ask how many children are travelling and how old they are, because booking partners need ages to price a room correctly. Those numbers travel in the plan link and in the booking link, and are not stored by us. Do not put a child’s name anywhere on the site — nothing here asks for one.

Server logs. Our hosting provider records ordinary request logs (things like the page requested, a timestamp, and the IP address making the request) for security and troubleshooting, under its own retention schedule. Separately, when someone follows a booking link we write a single line noting which kind of page it came from, which partner it went to and which hotel — with no identifier for the person who clicked. Those lines cannot be traced back to you or joined together into a history.

• No analytics. No Google Analytics, no tag manager, no page-view tracker, no session recording, no heatmaps.
• No advertising trackers and no advertising cookies.
• No accounts. There is no sign-up, no password and no login anywhere on the site.
• No profile. We do not build a picture of you across visits, and nothing you do on one page is linked to what you did on another.
• No payment details. Booking and paying happen entirely on the partner’s website. We never see a card number.

Where the law asks for a lawful basis: the cookies and the plan link exist because you asked for the feature they support, and emailing you a plan happens on your explicit request. Our interest in keeping the site working and free of abuse covers the server logs and the rate-limit counter. There is no advertising or profiling to justify, because there is none.

• Our hosting provider, which serves the site and keeps the request logs described above.
• Our email provider, which delivers a plan you asked us to send. It acts on our instructions and does not use your address for anything else.
• Booking partners, only when you choose to go to them. Following a booking link takes you to their site, where their own privacy policy applies. The link carries the hotel, and any dates and party size you entered, so the page is priced correctly. It carries no name, address or identifier for you. See our affiliate disclosure.

These providers operate outside the Philippines, so the limited data above is processed abroad. We do not share personal data with anyone else, and we do not sell it.

The two cookies expire on their own — the details are on the cookies page, and clearing them in your browser removes them immediately. An email address used to send a plan is discarded as soon as the message is handed to the provider. The abuse counter clears within an hour. Server logs follow the hosting and email providers’ own schedules.

Under RA 10173 and the GDPR you have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to how it is used, and to complain to a regulator — in the Philippines, the National Privacy Commission.

In practice the honest answer to most such requests is that we hold nothing: there is no account to look up and no stored record tied to you. The data that exists about your visit lives in your own browser, and clearing your browsing data for this site erases all of it without asking us. If you would like us to confirm that, or you think we hold something we should not, write to [email protected] and we will answer.

CebuFest is a travel planning site for adults. It is not directed at children and we do not knowingly collect personal data from them. The only thing the site ever asks about a child is an age, entered by the adult planning the trip, so that a room can be priced.

If what we do with data changes, this page changes with it and the date at the top moves. That date only moves when the words do — it is not a build stamp. Because the site is still being built, some of the statements here are true precisely because a feature does not exist yet; if that feature arrives, so does a new version of this page.